Support login via Direct Workload Identity Federation about login-action

[mozisan]

This works for me.

- uses: google-github-actions/auth@v2
  with:
    project_id: ...
    workload_identity_provider: ...
- run: gcloud auth configure-docker ${{ secrets.MY_REGISTRY }}

[cbini]

Closing, as I no longer use this action after this resolution. Not sure if there's a way to integrate using the gcloud credHelper into the action, but maybe it could be helpful in the future.

[bjornherder]

It is possible by adding the argument token_format: "access_token" to the google-github-actions/auth@v2 action. Here is a link to the docs.

The access token can then be supplied through the password argument, i.e. password: "${{ steps.auth.outputs.access_token }}"

[cbini]

This works for me.

- uses: google-github-actions/auth@v2
  with:
    project_id: ...
    workload_identity_provider: ...
- run: gcloud auth configure-docker ${{ secrets.MY_REGISTRY }}

Thanks for this! Figured I could use the Docker login action, but I'll give this a try.

[cbini]

@mozisan do you have a full workflow example you could share? I'm trying gcloud auth configure-docker, but the docker/build-push-action is still failing with:

ERROR: failed to push us-central1-docker.pkg.dev/.../.../...: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://us-central1-docker.pkg.dev/v2/token?scope=repository%3A...%2F...%2F...%3Apull%2Cpush&service=us-central1-docker.pkg.dev: 403 Forbidden

(my repo-specific info removed)

EDIT: my issue was Step 5 -- the workload identity pool principalSet needed the IAM binding with artifact registry permissions